Gitiles
Code Review Sign In
gerrit.nordix.org / onap / oom / 5d3e392fdf1f87b49c8b9df31324c61e88152716 / . / kubernetes / contrib / ingress-nginx-post-inst / nginx_ingress_cluster_config.yaml
blob: 937828a759e517a6b59d50691038ae34beba126f [file] [log] [blame]
Lucjan Bryndzaa6b7f872019-09-25 11:51:08 +0000[diff] [blame]1apiVersion: v1
2kind: Namespace
3metadata:
4 name: ingress-nginx
5 labels:
6 app.kubernetes.io/name: ingress-nginx
7 app.kubernetes.io/part-of: ingress-nginx
8
9---
10
11kind: ConfigMap
12apiVersion: v1
13metadata:
14 name: nginx-configuration
15 namespace: ingress-nginx
16 labels:
17 app.kubernetes.io/name: ingress-nginx
18 app.kubernetes.io/part-of: ingress-nginx
19
20---
21kind: ConfigMap
22apiVersion: v1
23metadata:
24 name: tcp-services
25 namespace: ingress-nginx
26 labels:
27 app.kubernetes.io/name: ingress-nginx
28 app.kubernetes.io/part-of: ingress-nginx
29
30---
31kind: ConfigMap
32apiVersion: v1
33metadata:
34 name: udp-services
35 namespace: ingress-nginx
36 labels:
37 app.kubernetes.io/name: ingress-nginx
38 app.kubernetes.io/part-of: ingress-nginx
39
40---
41apiVersion: v1
42kind: ServiceAccount
43metadata:
44 name: nginx-ingress-serviceaccount
45 namespace: ingress-nginx
46 labels:
47 app.kubernetes.io/name: ingress-nginx
48 app.kubernetes.io/part-of: ingress-nginx
49
50---
51apiVersion: rbac.authorization.k8s.io/v1beta1
52kind: ClusterRole
53metadata:
54 name: nginx-ingress-clusterrole
55 labels:
56 app.kubernetes.io/name: ingress-nginx
57 app.kubernetes.io/part-of: ingress-nginx
58rules:
59 - apiGroups:
60 - ""
61 resources:
62 - configmaps
63 - endpoints
64 - nodes
65 - pods
66 - secrets
67 verbs:
68 - list
69 - watch
70 - apiGroups:
71 - ""
72 resources:
73 - nodes
74 verbs:
75 - get
76 - apiGroups:
77 - ""
78 resources:
79 - services
80 verbs:
81 - get
82 - list
83 - watch
84 - apiGroups:
85 - ""
86 resources:
87 - events
88 verbs:
89 - create
90 - patch
91 - apiGroups:
92 - "extensions"
93 - "networking.k8s.io"
94 resources:
95 - ingresses
96 verbs:
97 - get
98 - list
99 - watch
100 - apiGroups:
101 - "extensions"
102 - "networking.k8s.io"
103 resources:
104 - ingresses/status
105 verbs:
106 - update
107
108---
109apiVersion: rbac.authorization.k8s.io/v1beta1
110kind: Role
111metadata:
112 name: nginx-ingress-role
113 namespace: ingress-nginx
114 labels:
115 app.kubernetes.io/name: ingress-nginx
116 app.kubernetes.io/part-of: ingress-nginx
117rules:
118 - apiGroups:
119 - ""
120 resources:
121 - configmaps
122 - pods
123 - secrets
124 - namespaces
125 verbs:
126 - get
127 - apiGroups:
128 - ""
129 resources:
130 - configmaps
131 resourceNames:
132 # Defaults to "<election-id>-<ingress-class>"
133 # Here: "<ingress-controller-leader>-<nginx>"
134 # This has to be adapted if you change either parameter
135 # when launching the nginx-ingress-controller.
136 - "ingress-controller-leader-nginx"
137 verbs:
138 - get
139 - update
140 - apiGroups:
141 - ""
142 resources:
143 - configmaps
144 verbs:
145 - create
146 - apiGroups:
147 - ""
148 resources:
149 - endpoints
150 verbs:
151 - get
152
153---
154apiVersion: rbac.authorization.k8s.io/v1beta1
155kind: RoleBinding
156metadata:
157 name: nginx-ingress-role-nisa-binding
158 namespace: ingress-nginx
159 labels:
160 app.kubernetes.io/name: ingress-nginx
161 app.kubernetes.io/part-of: ingress-nginx
162roleRef:
163 apiGroup: rbac.authorization.k8s.io
164 kind: Role
165 name: nginx-ingress-role
166subjects:
167 - kind: ServiceAccount
168 name: nginx-ingress-serviceaccount
169 namespace: ingress-nginx
170
171---
172apiVersion: rbac.authorization.k8s.io/v1beta1
173kind: ClusterRoleBinding
174metadata:
175 name: nginx-ingress-clusterrole-nisa-binding
176 labels:
177 app.kubernetes.io/name: ingress-nginx
178 app.kubernetes.io/part-of: ingress-nginx
179roleRef:
180 apiGroup: rbac.authorization.k8s.io
181 kind: ClusterRole
182 name: nginx-ingress-clusterrole
183subjects:
184 - kind: ServiceAccount
185 name: nginx-ingress-serviceaccount
186 namespace: ingress-nginx
187
188---
189
190apiVersion: apps/v1
191kind: Deployment
192metadata:
193 name: nginx-ingress-controller
194 namespace: ingress-nginx
195 labels:
196 app.kubernetes.io/name: ingress-nginx
197 app.kubernetes.io/part-of: ingress-nginx
198spec:
199 replicas: 1
200 selector:
201 matchLabels:
202 app.kubernetes.io/name: ingress-nginx
203 app.kubernetes.io/part-of: ingress-nginx
204 template:
205 metadata:
206 labels:
207 app.kubernetes.io/name: ingress-nginx
208 app.kubernetes.io/part-of: ingress-nginx
209 annotations:
210 prometheus.io/port: "10254"
211 prometheus.io/scrape: "true"
212 spec:
213 serviceAccountName: nginx-ingress-serviceaccount
214 containers:
215 - name: nginx-ingress-controller
216 image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.25.1
217 args:
218 - /nginx-ingress-controller
219 - --configmap=$(POD_NAMESPACE)/nginx-configuration
220 - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
221 - --udp-services-configmap=$(POD_NAMESPACE)/udp-services
222 - --publish-service=$(POD_NAMESPACE)/ingress-nginx
223 - --annotations-prefix=nginx.ingress.kubernetes.io
224 - --enable-ssl-passthrough=true
225 securityContext:
226 allowPrivilegeEscalation: true
227 capabilities:
228 drop:
229 - ALL
230 add:
231 - NET_BIND_SERVICE
232 # www-data -> 33
233 runAsUser: 33
234 env:
235 - name: POD_NAME
236 valueFrom:
237 fieldRef:
238 fieldPath: metadata.name
239 - name: POD_NAMESPACE
240 valueFrom:
241 fieldRef:
242 fieldPath: metadata.namespace
243 ports:
244 - name: http
245 containerPort: 80
246 - name: https
247 containerPort: 443
248 livenessProbe:
249 failureThreshold: 3
250 httpGet:
251 path: /healthz
252 port: 10254
253 scheme: HTTP
254 initialDelaySeconds: 10
255 periodSeconds: 10
256 successThreshold: 1
257 timeoutSeconds: 10
258 readinessProbe:
259 failureThreshold: 3
260 httpGet:
261 path: /healthz
262 port: 10254
263 scheme: HTTP
264 periodSeconds: 10
265 successThreshold: 1
266 timeoutSeconds: 10
267
268---
269kind: Service
270apiVersion: v1
271metadata:
272 name: ingress-nginx
273 namespace: ingress-nginx
274 labels:
275 app.kubernetes.io/name: ingress-nginx
276 app.kubernetes.io/part-of: ingress-nginx
277spec:
278 externalTrafficPolicy: Local
279 type: LoadBalancer
280 selector:
281 app.kubernetes.io/name: ingress-nginx
282 app.kubernetes.io/part-of: ingress-nginx
283 ports:
284 - name: http
285 port: 80
286 targetPort: http
287 - name: https
288 port: 443
289 targetPort: https
290
291---
292
293apiVersion: v1
294kind: Service
295metadata:
296 name: ingress-nginx
297 namespace: ingress-nginx
298 labels:
299 app.kubernetes.io/name: ingress-nginx
300 app.kubernetes.io/part-of: ingress-nginx
301spec:
302 type: NodePort
303 ports:
304 - name: http
305 port: 80
306 targetPort: 80
307 protocol: TCP
308 - name: https
309 port: 443
310 targetPort: 443
311 protocol: TCP
312 selector:
313 app.kubernetes.io/name: ingress-nginx
314 app.kubernetes.io/part-of: ingress-nginx
315
316---
317